Re: [PATCH v2] perf trace: Fix SIGSEGV when processing syscall args

[Naveen N. Rao]

Hi Namhyung,

Namhyung Kim wrote:
> Hello,
>
> On Thu, Jul 7, 2022 at 2:09 AM Naveen N. Rao
> <naveen.n.rao@xxxxxxxxxxxxxxxxxx> wrote:
> > On powerpc, 'perf trace' is crashing with a SIGSEGV when trying to
> > process a perf.data file created with 'perf trace record -p':
> >
> >   #0  0x00000001225b8988 in syscall_arg__scnprintf_augmented_string <snip> at builtin-trace.c:1492
> >   #1  syscall_arg__scnprintf_filename <snip> at builtin-trace.c:1492
> >   #2  syscall_arg__scnprintf_filename <snip> at builtin-trace.c:1486
> >   #3  0x00000001225bdd9c in syscall_arg_fmt__scnprintf_val <snip> at builtin-trace.c:1973
> >   #4  syscall__scnprintf_args <snip> at builtin-trace.c:2041
> >   #5  0x00000001225bff04 in trace__sys_enter <snip> at builtin-trace.c:2319
> >
> > That points to the below code in tools/perf/builtin-trace.c:
> >         /*
> >          * If this is raw_syscalls.sys_enter, then it always comes with the 6 possible
> >          * arguments, even if the syscall being handled, say "openat", uses only 4 arguments
> >          * this breaks syscall__augmented_args() check for augmented args, as we calculate
> >          * syscall->args_size using each syscalls:sys_enter_NAME tracefs format file,
> >          * so when handling, say the openat syscall, we end up getting 6 args for the
> >          * raw_syscalls:sys_enter event, when we expected just 4, we end up mistakenly
> >          * thinking that the extra 2 u64 args are the augmented filename, so just check
> >          * here and avoid using augmented syscalls when the evsel is the raw_syscalls one.
> >          */
> >         if (evsel != trace->syscalls.events.sys_enter)
> >                 augmented_args = syscall__augmented_args(sc, sample, &augmented_args_size, trace->raw_augmented_syscalls_args_size);
> >
> > As the comment points out, we should not be trying to augment the args
> > for raw_syscalls. However, when processing a perf.data file, we are not
> > initializing those properly. Fix the same.
> >
> > Reported-by: Claudio Carvalho <cclaudio@xxxxxxxxxxxxx>
> > Signed-off-by: Naveen N. Rao <naveen.n.rao@xxxxxxxxxxxxxxxxxx>
> > ---
> >  tools/perf/builtin-trace.c | 2 ++
> >  1 file changed, 2 insertions(+)
> >
> > diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
> > index 897fc504918b91..f075cf37a65ef8 100644
> > --- a/tools/perf/builtin-trace.c
> > +++ b/tools/perf/builtin-trace.c
> > @@ -4280,6 +4280,7 @@ static int trace__replay(struct trace *trace)
> >                 goto out;
> >
> >         evsel = evlist__find_tracepoint_by_name(session->evlist, "raw_syscalls:sys_enter");
> > +       trace->syscalls.events.sys_enter = evsel;
> >         /* older kernels have syscalls tp versus raw_syscalls */
>
> Isn't it better to set it after the NULL check below?

> From trace__sys_enter():
	/*
	 * If this is raw_syscalls.sys_enter, then it always comes with the 6 possible
	 * arguments, even if the syscall being handled, say "openat", uses only 4 arguments
	 * this breaks syscall__augmented_args() check for augmented args, as we calculate
	 * syscall->args_size using each syscalls:sys_enter_NAME tracefs format file,
	 * so when handling, say the openat syscall, we end up getting 6 args for the
	 * raw_syscalls:sys_enter event, when we expected just 4, we end up mistakenly
	 * thinking that the extra 2 u64 args are the augmented filename, so just check
	 * here and avoid using augmented syscalls when the evsel is the raw_syscalls one.
	 */
	if (evsel != trace->syscalls.events.sys_enter)
		augmented_args = syscall__augmented_args(sc, sample, &augmented_args_size, trace->raw_augmented_syscalls_args_size);

> From the previous discussion [1], it looks like the assumption above is 
that sys_enter would be set to raw_syscalls.

As such, I set it before the NULL check below, which ends up falling 
back to the non-raw syscalls tracepoint.


Thanks,
Naveen

[1] https://lore.kernel.org/all/YjDSRb1wwswKpJNJ@xxxxxxxxxx/